The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Atlassian Subscribe
Jira Data Center Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Atlassian Subscribe
Jira Data Center Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history cve-icon cve-icon
https://thestarware.atlassian.net/wiki/spaces/WLP/pages/3326574597/Security+Advisory+CVE-2025-57681+-+Stored+XSS+in+WorklogPRO+DC cve-icon cve-icon
https://thestarware.atlassian.net/wiki/x/CAAdyg cve-icon cve-icon
History

Wed, 21 Jan 2026 20:30:00 +0900

Type Values Removed Values Added
First Time appeared Atlassian
Atlassian jira Data Center
Vendors & Products Atlassian
Atlassian jira Data Center

Wed, 21 Jan 2026 16:30:00 +0900

Type Values Removed Values Added
Description The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.1-jira9, 4.24.1-jira10, and 4.24.1-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action. The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.
References

Wed, 21 Jan 2026 00:45:00 +0900

Type Values Removed Values Added
Description The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.1-jira9, 4.24.1-jira10, and 4.24.1-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-01-21T07:11:47.476Z

Reserved: 2025-12-12T00:00:00.000Z

Link: CVE-2025-67824

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-01-20T16:16:06.517

Modified: 2026-01-21T08:15:59.053

Link: CVE-2025-67824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-21T20:20:05Z

Weaknesses

No weakness.